Debian 12 – journald uses excessive disk space and fills root filesystem

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Root filesystem usage spikes and services fail due to no space left on device.

Environment & Reproduction

Common on verbose workloads without journal retention limits.

Root Cause Analysis

Persistent journald storage grows without effective size/time constraints.

Quick Triage

Measure journal footprint and identify top log-generating services.

Step-by-Step Diagnosis

Assess journal size and error volume trends.
– shell: `journalctl –disk-usage && sudo du -sh /var/log/journal`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘journalctl -p err -b –no-pager | tail -n 60’))”`
– perl: `perl -e ‘print q{Determine if persistence is required by policy}’`

Solution – Primary Fix

Vacuum old logs and set controlled journald retention limits.
– shell: `sudo journalctl –vacuum-time=14d`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘sudo systemctl restart systemd-journald’))”`
– perl: `perl -e ‘print q{Set SystemMaxUse in journald.conf}’`

Solution – Alternative Approaches

Forward logs to centralized storage and reduce local persistence footprint.

Verification & Acceptance Criteria

Disk usage returns to healthy threshold and log retention matches policy.

Rollback Plan

Revert retention settings if required audit window was reduced too aggressively.

Prevention & Hardening

Set alerting on journal growth and service error bursts.

Related Errors & Cross-Refs

Related to /var full conditions and logrotate coordination gaps.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

journald.conf(5), journalctl(1), and Debian logging best practices.